/**
 * @openapi
 * /api/iam/capabilities:
 *   get:
 *     tags: [IAM]
 *     summary: Current user's derived IAM capabilities
 *     description: >
 *       Returns role-hierarchy and tenant-creation capabilities derived from
 *       effective permissions plus backend role-policy. Frontend forms use this
 *       instead of owning role-name allowlists.
 *     responses:
 *       200: { description: Capability payload. }
 *       401: { $ref: '#/components/responses/UnauthorizedError' }
 */
import express from 'express';
import { current } from '@/api/controllers/iam_capabilities.controller';

const router = express.Router();

router.get('/capabilities', current);

export default router;
